Assignment 8. Buffer overruns

Useful pointers

• Elias Levy a.k.a. Aleph One, Smashing the stack for fun and profit, Phrack 7, 49 (1996-11-08), file 14
• U.S. National Vulnerability Database
• CERT Coordination Center
• David Wheeler, Secure programming for Linux and Unix HOWTO—creating secure software (2014-02-16)
• Julian Seward et al., Valgrind quick start guide (2013-10-31)
• Julian Seward et al., Valgrind user manual (2013-10-31)
• Getting started with Amazon EC2 Linux instances (2013-10-15)
• Ken Thompson, Reflections on trusting trust, Communications of the ACM 27, 8 (1984-08), 761–63, doi:10.1145/358198.358210

Laboratory: Exploiting a buffer overrun

As usual, keep a log in the file lab.txt of what you do in the lab so that you can reproduce the results later. This should not merely be a transcript of what you typed: it should be more like a true lab notebook, in which you briefly note down what you did and what happened.

For this laboratory, you will find and exploit a simple buffer overrun in a web server.

Consider the following patch to sthttpd. This patch applies to sthttpd 2.26.4.

diff -pru sthttpd-2.26.4/src/thttpd.c sthttpd-2.26.4-new/src/thttpd.c
--- sthttpd-2.26.4/src/thttpd.c	2012-07-13 04:32:59.000000000 -0700
+++ sthttpd-2.26.4-new/src/thttpd.c	2012-11-18 22:11:39.275115033 -0800
@@ -1600,7 +1600,7 @@ handle_read( connecttab* c, struct timev
     /* Read some more bytes. */
     sz = read(
 	hc->conn_fd, &(hc->read_buf[hc->read_idx]),
-	hc->read_size - hc->read_idx );
+	hc->read_size );
     if ( sz == 0 )
 	{
 	httpd_send_err( hc, 400, httpd_err400title, "", httpd_err400form, "" );

1. Build sthttpd with this patch applied, and run the modified thttpd daemon on port 8080 on your host. You may find the thttpd man page useful.
2. Verify that your web server works in the normal case.
3. Make your web server crash by sending it a suitably-formatted request.
4. Run your web server under GDB, and get a traceback immediately after the crash.
5. Briefly describe how you'd go about building a remote exploit for the bug in the modified thttpd. Your exploit should allow you to conduct a highly-effective denial-of-service attack on the web server, or perhaps even run arbitrary code on the web server.
6. Will GCC's -fstack-protector option help? Use GCC's -S option to generate the assembly language code for thttpd.c twice, once with -fstack-protector, and once with -fno-stack-protector. Call the resulting files thttpd-stackprot.s and thttpd-nostackprot.s. Use diff to compare the two assembly-language files. Which code looks less efficient, and why? Write a simple shell command that invokes diff and determines which functions are called (in the sense of the machine-language call instruction) by one version and not the other, and use the command to see what functions these are. Will these extra functions prevent your exploit?
7. Will AddressSanitizer option help? Build the patched thttpd with -fsanitize=address -fstack-protector, run it under GDB, send it a suitably-formatted request, and see what the traceback looks like. Note that -fsanitize=address requires the use of the linker option -Xlinker --rpath=... as illustrated below. Do your experiment on the SEASnet GNU/Linux servers: Use the port number specified by your T.A. (which is probably not port 8080), and compile in 32-bit mode using the CS version of GCC, with something like the following shell command:

   make CC="gcc -m32" \
     CFLAGS="-fsanitize=address -fstack-protector" \
     LDFLAGS="-Xlinker --rpath=/usr/local/cs/gcc-$(gcc -dumpversion)/lib"
   

8. Use GCC's -S option to generate the assembly language code for thttpd.c, with the -fsanitize=address -fstack-protector option. Call the resulting file thttpd-sanitize.s. Use diff to compare it to thttpd-stackprot.s. Which code looks less efficient, and why?
9. Will valgrind help? Try running your modified web server under valgrind; what does it do?

Homework: Reproducing under EC2; vulnerability review

This homework has two parts: reproducing the lab results under EC2, and reviewing some recent vulnerabilities.

First, get access to a fresh Amazon EC2 instance (you can get a free one from Amazon AWS) and reproduce on it the web server crash that you did during the lab. Take notes on all the steps you needed to do. If you can't set up the server and reproduce the problem, give details about why not.

Second, look at some recent known vulnerabilities under the following assumption. Suppose you have built and deployed a networked application from standard software components and are now worried that the application might be vulnerable to outside attackers via the Internet. Assume that each of the following entries in the CERT Vulnerability Notes Database describes a component of your system. Rank the seriousness of each vulnerability, so that the most urgent vulnerability is listed first. (By "urgent" we mean "urgent that you stay up all night if necessary and fix this right away in your deployed system".) Justify your rankings by evaluating the plausibility of attack scenarios.

• VU#213119 (2014-11-18) Microsoft Windows Kerberos Key Distribution Center (KDC) fails to properly validate Privilege Attribute Certificate (PAC) signature
• VU#505120 (2014-11-13) Microsoft Secure Channel (Schannel) vulnerable to remote code execution via specially crafted packets
• VU#447516 (2014-11-07) Linksys SMART WiFi firmware contains multiple vulnerabilities
• VU#252743 (2014-09-25) GNU Bash shell executes commands in exported functions in environment variables
• VU#720951 (2014-04-07) OpenSSL TLS heartbeat extension read overflow discloses sensitive information

Submit

Submit the following files.

• The files lab.txt and thttpd-sanitize.s as described in the lab.
• A file hw.txt containing your answer to the homework.

All files should be ASCII text files, with no carriage returns, and with no more than 200 columns per line. The shell command

expand lab.txt hw.txt |
  awk '/\r/ || 200 < length'

should output nothing.